{"id":"CVE-2026-86322","kind":"vulnerability","aliases":["CVE-2026-86322"],"related":[],"title":"Foreman: low-privilege users can mint access tokens for other accounts","description":"A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization check. An attacker with the create_personal_access_tokens permission can therefore invoke POST /api/v2/users/:user_id/personal_access_tokens with another user’s ID and create a Personal Access Token on their behalf. The resulting plaintext token is returned in the API response, while PersonalAccessToken#check_permissions_after_save only validates create_personal_access_tokens on the token and does not enforce edit_users authorization on the target user. The attacker can then use the forged token to authenticate as the victim, potentially resulting in complete account takeover, including administrator accounts.","summary":"Foreman's personal access token API (POST /api/v2/users/:user_id/personal_access_tokens) does not check that the caller may manage the target user. A user with the create_personal_access_tokens permission can create a token for another account, including an administrator, and receives the plaintext token. They can then authenticate as that user. Red Hat rates it CVSS 8.8 and lists Satellite 6 as affected. No affected Foreman versions or fixed release are published yet.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Red Hat Satellite 6","fixed":[],"affected":"version range not published","ecosystem":"vendor"}],"ecosystems":[],"tags":["api","foreman","infrastructure","red-hat-satellite","self-hosted"],"not_affected_if":["no-create-personal-access-tokens-role","no-token-permission-users"],"how_to_check":"Check whether any non-admin user or role has the create_personal_access_tokens permission (Administer > Roles). Affected Foreman versions are not published yet, so any Foreman or Red Hat Satellite 6 instance with such roles should be treated as exposed until a fixed release is announced. Review existing personal access tokens on privileged users for ones you did not create.","fix":null,"status":"open","published_at":"2026-11-12T21:17:33+00:00","first_seen_at":"2026-11-12T21:40:31+00:00","triaged_at":"2026-11-12T21:42:21+00:00","updated_at":"2026-11-12T21:44:11+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-12T21:42:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Foreman: low-privilege users can mint access tokens for other accounts","impact":"high","summary":"Foreman's personal access token API does not check that the caller may manage the target user, so a user with token-creation rights can create a token for another account and get the plaintext token back. The attacker can then log in as that victim, including administrators, for full account takeover.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["foreman","self-hosted","api"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker takes over any account, including administrators","analyst_note":"Find affected Foreman versions and the fixed release from the NVD entry or Foreman advisories; the sources given do not list product ranges.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-token-permission-users"],"who_is_affected":"Any Foreman deployment where some users hold the create_personal_access_tokens permission can be affected, because the flaw lets them create tokens for other users including administrators. Installations where only fully trusted users can create tokens, or where the API is reachable only by administrators, are lower risk. The sources do not state affected versions or a fix.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000708,"input_tokens":4715,"output_tokens":472,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected Foreman versions and the fixed release from the NVD entry or Foreman advisories; the sources given do not list product ranges.","search":"'-2026':14A,17A '-86322':15A,18A '/api/v2/users':40B,154C '6':22A,94B '8.8':90B 'access':8A,36B,60B,147C,166C,191C 'account':12A,69B,126C,224C,228C 'administr':72B,227C 'affect':96B,98B 'anoth':68B,158C 'api':23B,38B,114C,179C 'appli':133C 'attack':142C,208C 'authent':81B,216C 'author':139C,202C 'behalf':170C 'caller':48B 'check':45B,140C,183C 'complet':223C 'control':119C 'creat':58B,64B,145C,163C,189C 'cve':13A,16A 'cvss':89B 'edit':200C 'enforc':199C 'find':121C 'fix':102B 'flaw':108C 'foreman':1A,24B,33B,99B,112C,118C 'forg':213C 'found':110C 'hat':20A,28B,86B 'host':32B 'id':131C,161C 'id/personal_access_tokens':42B,156C 'includ':70B,226C 'infrastructur':25B 'invok':152C 'list':92B 'low':3A 'low-privileg':2A 'manag':50B 'may':49B 'mint':7A 'param':129C 'parent':137C 'parent-us':136C 'permiss':62B,149C,184C 'person':35B,59B,146C,165C,190C 'personalaccesstoken':182C 'personalaccesstokenscontrol':116C 'plaintext':76B,173C 'post':39B,153C 'potenti':220C 'privileg':4A 'publish':105B 'rate':87B 'receiv':74B 'red':19A,27B,85B 'red-hat-satellit':26B 'releas':103B 'requir':135C 'resolv':123C 'respons':180C 'result':172C,221C 'return':176C 'satellit':29B,93B 'satellite':21A 'save':186C 'self':31B 'self-host':30B 'takeov':225C 'target':52B,125C,205C 'therefor':151C 'token':9A,37B,61B,66B,77B,148C,167C,174C,192C,195C,214C 'use':127C,211C 'user':5A,41B,53B,55B,84B,122C,130C,138C,155C,159C,201C,206C 'user.find':128C 'userawar':120C 'v2':115C 'valid':188C 'version':100B 'victim':219C 'without':132C 'yet':106B","nicknames":[],"mitigations":[],"who_affected":"Any Foreman deployment where some users hold the create_personal_access_tokens permission can be affected, because the flaw lets them create tokens for other users including administrators. Installations where only fully trusted users can create tokens, or where the API is reachable only by administrators, are lower risk. The sources do not state affected versions or a fix.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["hatsatellite6","redhatsatellite6"],"ptokens":["hat","red","satellite"],"labels":["api","foreman","high","infrastructure","redhatsatellite","selfhosted"],"campaign_type":null,"search_a":"'-2026':14A,17A '-86322':15A,18A '6':22A 'access':8A 'account':12A 'cve':13A,16A 'foreman':1A 'hat':20A 'low':3A 'low-privileg':2A 'mint':7A 'privileg':4A 'red':19A 'satellite':21A 'token':9A 'user':5A","search_b":"'/api/v2/users':40B '6':94B '8.8':90B 'access':36B,60B 'account':69B 'administr':72B 'affect':96B,98B 'anoth':68B 'api':23B,38B 'authent':81B 'caller':48B 'check':45B 'creat':58B,64B 'cvss':89B 'fix':102B 'foreman':24B,33B,99B 'hat':28B,86B 'host':32B 'id/personal_access_tokens':42B 'includ':70B 'infrastructur':25B 'list':92B 'manag':50B 'may':49B 'permiss':62B 'person':35B,59B 'plaintext':76B 'post':39B 'publish':105B 'rate':87B 'receiv':74B 'red':27B,85B 'red-hat-satellit':26B 'releas':103B 'satellit':29B,93B 'self':31B 'self-host':30B 'target':52B 'token':37B,61B,66B,77B 'user':41B,53B,55B,84B 'version':100B 'yet':106B","search_c":"'/api/v2/users':154C 'access':147C,166C,191C 'account':126C,224C,228C 'administr':227C 'anoth':158C 'api':114C,179C 'appli':133C 'attack':142C,208C 'authent':216C 'author':139C,202C 'behalf':170C 'check':140C,183C 'complet':223C 'control':119C 'creat':145C,163C,189C 'edit':200C 'enforc':199C 'find':121C 'flaw':108C 'foreman':112C,118C 'forg':213C 'found':110C 'id':131C,161C 'id/personal_access_tokens':156C 'includ':226C 'invok':152C 'param':129C 'parent':137C 'parent-us':136C 'permiss':149C,184C 'person':146C,165C,190C 'personalaccesstoken':182C 'personalaccesstokenscontrol':116C 'plaintext':173C 'post':153C 'potenti':220C 'requir':135C 'resolv':123C 'respons':180C 'result':172C,221C 'return':176C 'save':186C 'takeov':225C 'target':125C,205C 'therefor':151C 'token':148C,167C,174C,192C,195C,214C 'use':127C,211C 'user':122C,130C,138C,155C,159C,201C,206C 'user.find':128C 'userawar':120C 'v2':115C 'valid':188C 'victim':219C 'without':132C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T21:17:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86322","severity":null,"published_at":"2026-11-12T21:17:33+00:00","modified_at":"2026-11-12T21:17:33+00:00","first_seen_at":"2026-11-12T21:40:31+00:00","fetched_at":"2026-11-12T21:40:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-86322:3786","url":"https://access.redhat.com/security/cve/CVE-2026-86322","severity":null,"published_at":"2026-11-12T21:44:11+00:00","modified_at":"2026-11-12T21:44:11+00:00","first_seen_at":"2026-11-12T21:44:11+00:00","fetched_at":"2026-11-12T21:44:11+00:00","note":"Red Hat CNA page + CVE record read: flaw in Api::V2::PersonalAccessTokensController (find_user lacks authorization on target user); CVSS 8.8, CWE-639. No affected/fixed Foreman versions published yet; Foreman security page does not list it and the Red Hat page has no fix. Nothing verified. Not a code-checkable condition without versions.","cites":["https://access.redhat.com/security/cve/CVE-2026-86322","https://www.theforeman.org/security.html"]}],"documents":[{"id":139459,"url":"https://access.redhat.com/security/cve/CVE-2026-86322","title":"Red Hat CVE-2026-86322 (CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":139460,"url":"https://www.theforeman.org/security.html","title":"Foreman security advisories (CVE-2026-86322 not listed as of 2026-11-12)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}